11–20 of 54 posts
Earlier quoted context omitted.
From a glance at the GitHub page, it looks like you can self-host the project. Is "bower install" a possible attack vector as well? I'm unfamiliar with it.
Bower is a package manager for Javascript libraries. So the only attack vector would be a MIT attack, intercepting the requests to the Bower registry.
This is a cool implementation of this idea. Proof of work is probably an acceptable solution for proof of concept but anonymous consensus isn't needed for for collaborative document editing. I'm still thinking if this use cases needs timestamping or atomic broadcast.If timestamping is sufficient, Google's new roughtime protocol would do the job well. Otherwise you need a proper atomic broadcast algorithim like RAFT,…
Sharing the URL is essentially giving out the key, so there is no digitally safe way to do this unless you encrypt the initial message, at which stage you are using encrypted communication anyway and the URL just leaves open an attack vector. Please correct me if I am wrong.
Seem to me the point is to use a secure channel to share the URL with your collaborators, and after that you can use a blockchain to host your collaborative edits instead of having to run a server.
Sharing the URL is essentially giving out the key, so there is no digitally safe way to do this unless you encrypt the initial message, at which stage you are using encrypted communication anyway and the URL just leaves open an attack vector. Please correct me if I am wrong.
This is where the value-added of Cryptpad lies: Yes, you need to already be able to exchange encrypted messages with your partner, but this will allow you to work on a document together in a secure[1] fashion.
For me, this is quite an achievement and not nothing.
[1]: "Secure" with all the caveats pointed out in the other comments below, e.g. if you do not self-host but use the cryptpad.fr server you need to trust them not to send malicious JavaScript to your browser.
DISCLAIMER: I've spent way too much time on synchronized CodeMirror editing...
Zero knowledge has a very specific meaning inside cryptography. Encrypting something does not make it "zero knowledge".
I think it's kind of odd to draw such a strong comparison to the Bitcoin blockchain. As the technical description [1] points out, the "chainpad" system discards most of the features and properties that make Bitcoin secure against malicious participants. That seems like a totally reasonable design decision for this application, but then describing it as a blockchain just adds confusion.
In fact, the design seems to bear a much closer resemblance to the Bayou optimistic concurrency algorithm [2], with operational transformation as the underlying data model, and some extra crypto on top.
[1]: https://github.com/xwiki-contrib/chainpad
[2]: http://www.cs.utexas.edu/users/lorenzo/corsi/cs380d/papers/p...
Earlier quoted context omitted.
From a glance at the GitHub page, it looks like you can self-host the project. Is "bower install" a possible attack vector as well? I'm unfamiliar with it.
Bower is a package manager for Javascript libraries. So the only attack vector would be a MIT attack, intercepting the requests to the Bower registry.